Update @schematics/update to remove the vulnerability introduced in schematics-utilities

[evansrobert]

Hi, @nitayneeman, I'd like to report a vulnerability introduced by package ini@1.3.5:

Issue Description

I noticed that a vulnerability is introduced in _schematics-utilities@2.0.3 _:
Vulnerability CVE-2020-7788 (high severity) affects package ini (versions:<1.3.6): https://snyk.io/vuln/SNYK-JS-INI-1048974
The above vulnerable package is referenced by schematics-utilities@2.0.3 via:
schematics-utilities@2.0.3 ➔ @schematics/update@0.803.29 ➔ ini@1.3.5

Since schematics-utilities@2.0.3 (20,943 downloads per week) is referenced by 37 downstream projects (e.g., @datorama/akita 6.2.3 (latest version), @scullyio/init 1.1.4 (latest version), @sentinel-one/mgmt-schematics 2.0.10 (latest version), @flarehr/apollo-benefits 2.2.19 (latest version), @flarehr/cars-calculator 2.2.19 (latest version)), the vulnerability CVE-2020-7788 can be propagated into these downstream projects and expose security threats to them via the following package dependency paths:
(1)@datorama/akita@6.2.1 ➔ schematics-utilities@2.0.3 ➔ @schematics/update@0.803.29 ➔ ini@1.3.5
(2)@flarehr/apollo-benefits@2.1.236 ➔ @datorama/akita@6.2.1 ➔ schematics-utilities@2.0.3 ➔ @schematics/update@0.803.29 ➔ ini@1.3.5
......

If schematics-utilities@2.0.* removes the vulnerable package from the above version, then its fixed version can help downstream users decrease their pain.

Given the large number of downstream users, could you help update your package to remove the vulnerability from schematics-utilities@2.0.3 ?

Fixing suggestions

In schematics-utilities@2.0.4, maybe you can kindly try to perform the following upgrade(not crossing major version) :
@schematics/update ^0.803.8 ➔ ^0.1100.5;

Note:
@schematics/update@0.1100.5(>=0.1100.5) directly depends on ini@1.3.6 which has fixed the vulnerability CVE-2020-7788.
Of course, you are welcome to share other ways to resolve the issue.

Thank you for your attention to this issue.

Best regards,
^_^

[maciejniedzielski]

Hi,
I have same vulnerability problem using @ng-neat/svg-icons. Here is the npm ls ini result for this package.

Hope you will be able to fix it soon :)

[nitayneeman]

Hey guys,

I've tried to merge a fix with an upgrade but reverted since @schematics/update@0.1100.5 brings breaking changes indirectly - it uses under the hood @angular-devkit/core in v11.0.7 containing breaking changes.

Actually there is another open issue: #39.

If you have another solution in your mind to bring ini@1.3.6 without having breaking changes - you're welcome to suggest or contribute.

[nunoarruda]

I only have a minor understanding of schematics so, sorry if the following questions don't make sense.

The @schematics/update package is deprecated, it is only supported on Angular <=11:

Is schematics-utilities fully dependent on @schematics/update? Or can it be "refactored" to stop using @schematics/update?

If it can be refactored then I guess the refactoring could be done and then schematics-utilities could release a new major version (v3) with Angular 12+ support only since this refactoring might be a breaking change.

[matthiassommer]

Any update on this? The vulnerability for ip 1.1.5 and ini 1.3.5 are still present.